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Claims 

1. A method for generating an undeniable signature (yi, y t ) on a set of data, 
the method comprising the following steps: 

- transforming the set of data (m) to a sequence of a predetermined number (?) of 
blocks (x-i, ... , x t ), these blocks being members of an Abelian group, this 
transformation being a one way function, 

- applying to each block (Xj) a group homomorphism (f) to obtain a resulting value 
(yi), in which a number of elements of an initial group (G) is larger than the number 
of elements (d) of a destination group (H). 

2. The method of claim 1 , wherein the initial group (G) is formed by invertible 
integers modulo n, i.e. . 

3. The method according to claim 2, wherein the group homomorphism (f) 
computation is based on computation of a residue character (%) on a set of 
elements Z^. 

4. The method according to claim 3, wherein the residue character {%) 
computation in based on a parameter (n) serving as a key. 

5. The method according to the claim 4, wherein this key parameter (71) is 
determined such as : 71 • n- n, W being the complex conjugate of 71. 

6. The method according to claim 2, wherein the group homomorphism (f) 
computation is determined in raising an element of 2£ to the power of r(q-1 ), in 

which n = p • q such that p = rd + 1 and q are prime, gcd(r, d) = 1 , gcd(g - 1 , d) = 1 , 
then by computing a discrete logarithm. 

7. The method according to claim 6, wherein the group homomorphism is 
calculated using a factorization of n. 
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8. The method according to claim 1 , wherein the length of the signature is 
dependent of the number of elements of the destination group (d) and the number 
of blocks (t). 

9. The method according to claim 4, wherein the parameter (n) is a secret key 
on an asymmetric key pair public/secret. 

10. A Method of confirming by a Verifier an undeniable signature (yi , . . . , y t ) of a 
set of data (m) generated by a Signer taking into account a predefined security 
parameter (k) of the confirmation protocol, this Signer having a public/secret key 
pair, this method comprising the following steps: 

- obtaining a personal value (p) from the Signer, this personal value being part of 
the public key (G, H, d, p, (ei , . . . e s )) of the Signer, 

- extracting a first sequence of elements (ei, ... e s ) from the public key, 

- generating a second sequence of elements (gi, ... gf s ) from the personal value 
«P>. 

- generating a third sequence of elements (xi, x t ) from the set of data (m), 

- randomly picking challenge parameters n e G and ay e Z d for i = 1, ... , k and j = 
1, s+t and computing a challenge value Uj = dn + angi + ... a is g s + a is +iyi + ... + 
ais+tyt , 

- sending by the Verifier the challenge value Ujto the Signer, 

- receiving from the Signer a commitment value (<Vj>), this commitment value (<Vj>) 
being calculated by the Signer based on a response value Vj = f(Ui), 

- sending by the Verifier the challenge parameters n and ay to the Signer, 

- verifying by the Signer whether Uj = dn + a i1 g 1 + ... a is g s + a is+ iyi + ... + a is+t yt, and 
in the positive event, opening by the Signer the commitment on the response value 

(Vi). 
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- verifying by the Verifier whether Vj = a it ei + ... a is e s + a is+ iyi + ... + a is+t yt. 

11. A method for denying to a Verifier by a Signer on an alleged non-signature 
(z1 , .... zt) of a set of data (m) , this signature being supposedly generated 
according to claim 1 by the Signer, this Signer having a public/secret key pair, this 
method taking into account a predefined security parameter (£) of the denial 
protocol and comprising the following steps: 

- obtaining by the Verifier a personal value (p) of the Signer, this personal value 
being part of the public key (G, H, d, p, (ei , . . . e s )) of the Signer, 

- extracting by the Verifier a first sequence of elements ( ei, ... e s ) from the public 
key, 

- generating by the Verifier and the Signer a second sequence of elements ( gi, ... 
g s ) from the personal value (p), 

- generating by the Verifier and the Signer a third sequence of elements (xi, .... Xj) 
from the set of data (m), 

- calculating by the Signer the true signature (y 1f y t ), 

- repeating the following steps t times, t being the predetermined security 
parameter, 

- randomly picking by the Verifier challenge parameters rj e G and ajj e Zd for i 
= 1 , . . . , s and j = 1 t and A e 2^ where p is the smallest prime dividing d, 

- computing U] := drj + ajigi + ... a js g s + Ax h and wj := ajiei + ... a js e s + Az> for j 
= 1 ..t, 

- sending by the Verifier the challenge values u, and wj to the Signer, 

- computing by the Signer a response test value TV] := (zj-yj). 

- for each j = 1 to t, determining whether the test value TVj =0, 
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- in the negative event, calculating a test parameter A\ according to the 
following formula : Wj-vj, = A\ (Zj-yj) 

- determining an intermediate value IV, this value being equal to one valid test 
parameter A and in case of no valid test parameter is found, selecting as 
intermediate value a random value, 

- sending a commitment value CT based on the intermediate value IV, to the 
Verifier, 

- sending by the Verifier the challenge parameters rj , ajj and test parameter A 
to the Signer, 

- verifying by the Signer whether uj = drj + ajigi + ... a js g s + Axj rand wj := ajiei 
+ ... a js e s + Azi for j = 1 .. t hold, in the positive event, the Signer opens the 
commitment on the intermediate value (IV) to the Verifier. 

- verifying by the Verifier that the test parameter A is equal to the intermediate 
value IV. 

12. The method of claim 1 1 , in which the determination of the valid test 
parameter comprises the check whether (Wj-Vj,) and (zj-yj) are not equal to 0. 

13. The method of claim 1 1 , in which j > 1 , the determination of the valid test 
parameter comprises the check whether (Wj-Vj.) and (zj-yj) are not equal to 0, and 
that all of the test parameters are the same. 



